Ask Key 1.0.1

Ask Key 1.0.1

Security fixes for three issues found in a review of 1.0.0, plus download verification. No features and no UI changes beyond one notice described below.

Security

• Agent-access pause state is now authenticated. Pause was a plain row in the local database, and a missing row read as "not paused". A program running as you could delete that row while Ask Key was closed and turn Agent access back on at the next start, without the Windows Hello confirmation that resuming normally asks for. Pause state now lives in a record encrypted with a key derived from your vault key, and a missing or unverifiable record reads as paused.
• Security settings are now authenticated. Whether read requests need confirmation, how long timed allowances last, and how long the management session lasts were read from settings.json, which is also writable by any program running as you. Editing that file could switch off read confirmation or set a session far longer than any option in Settings. These values now live in the same authenticated policy, and out-of-range values fall back to the strict defaults.
• The Broker now checks the host it connects to. A program running as you could stand up its own AskKey.exe in a known install folder and answer the pipe. The helper now requires the host to be the AskKey.exe belonging to its own install folder, and signed builds compare the publisher.

One-time notice after updating

Agent access is paused the first time you open Ask Key after this update, and a dialog explains why. This is the new policy failing closed on a library created before it existed. Choose Resume Agent access to turn it back on; the notice appears once.

Verify your download

Releases now include AskKey-1.0.1.sha256. After downloading:

Get-FileHash -Algorithm SHA256 .\AskKeySetup-1.0.1.exe

Compare with the matching line in AskKey-1.0.1.sha256.

Install

1. Download AskKeySetup-1.0.1.exe and allow the single UAC prompt. It installs Ask Key and the Ask Key Guard service. Running it over an existing 1.0.0 install upgrades in place; no uninstall is needed.
2. Open Ask Key, complete onboarding, and resume Agent access.

Uninstalling keeps saved credentials in %APPDATA%\AskKey. This build is unsigned, so Windows SmartScreen will warn.

See the English README.

---

Ask Key 1.0.1

修复了评审 1.0.0 时发现的三个安全问题，并增加了下载校验方式。除下面提到的一次性提示外，没有功能变化，界面也没有改动。

安全

• Agent 访问暂停状态现在经过认证。 暂停原本是本地数据库里的一行普通记录，而这一行不存在就等于「未暂停」。以你的身份运行的程序可以在 Ask Key 关闭时删掉它，下次启动就把 Agent 访问打开，完全绕过恢复时要求的 Windows Hello 确认。暂停状态现在存放在一条用 vault key 派生的密钥加密的记录里，记录缺失或无法验证时一律读作暂停。
• 安全设置现在经过认证。 读取请求是否需要确认、临时授权时长、管理会话时长原本从 settings.json 读取，而该文件同样可被任何以你的身份运行的程序改写。修改它就能关掉读取确认，或把会话设得远超设置里的任何选项。这些值现在放在同一份经过认证的策略里，超出范围的数值会退回严格默认值。
• Broker 现在会校验它连接的主机。 以你的身份运行的程序可以在已知安装目录里放一个自己的 AskKey.exe 来应答管道。Helper 现在要求主机必须是属于自身安装目录的那个 AskKey.exe，签名构建还会比较发布者。

更新后的一次性提示

更新后第一次打开 Ask Key 时，Agent 访问处于暂停状态，会弹窗说明原因。这是新策略在旧库上按「失败即关闭」规则处理的结果。选择恢复 Agent 访问即可重新开启，该提示只出现一次。

校验下载

本次发布附带 AskKey-1.0.1.sha256。下载后执行：

Get-FileHash -Algorithm SHA256 .\AskKeySetup-1.0.1.exe

与 AskKey-1.0.1.sha256 中对应的一行比对。

安装

1. 下载 AskKeySetup-1.0.1.exe，允许一次 UAC。安装器会同时安装 Ask Key 和 Ask Key Guard 服务。直接覆盖已装的 1.0.0 即可升级，不需要先卸载。
2. 打开 Ask Key，完成首次启动设置，并恢复 Agent 访问。

卸载不会删除 %APPDATA%\AskKey 中保存的凭据。当前构建未签名，Windows SmartScreen 会提示。

完整说明见 中文 README。